{"id":"CVE-2026-120752","title":"PyMuPDF 1.25.3 before 2.0 Stack Buffer Overflow via add_freetext_annot() Callout","summary":"PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callou…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-121"],"vendor":"PyMuPDF","product":"PyMuPDF","affected":["PyMuPDF >= 1.25.3 < 2.0"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-11-07T02:26:40.474256Z"},"exploitAvailable":true,"published":"2026-11-02","updated":"2026-11-07","sourceUpdated":"2026-11-07T02:27:07.671Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120752","references":[{"url":"https://github.com/pymupdf/PyMuPDF/issues/5112","label":"GitHub Issue #5112"},{"url":"https://github.com/pymupdf/PyMuPDF/issues/5173","label":"GitHub Issue #5173"},{"url":"https://github.com/pymupdf/PyMuPDF/commit/d4298ead84ceeae1c9065c81cd9a275a1b092f5e","label":"Patch Commit"},{"url":"https://github.com/pymupdf/PyMuPDF/blob/1.28.2/src/extra.i#L787-L797"},{"url":"https://github.com/pymupdf/PyMuPDF/releases/tag/2.0","label":"PyMuPDF 2.0 Release Notes"},{"url":"https://github.com/pymupdf/PyMuPDF"},{"url":"https://www.vulncheck.com/advisories/pymupdf-1.25.3-before-2.0-stack-buffer-overflow-via-add-freetext-annot-callout","label":"VulnCheck Advisory: PyMuPDF 1.25.3 before 2.0 Stack Buffer Overflow via add_freetext_annot() Callout"}],"tags":["cve.org","exploit-available"],"epss":0.00373,"epssPercentile":0.31515,"ingestedAt":"2026-11-05T19:30:42.873Z","slug":"CVE-2026-120752","body":"## Overview\n\nPyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JM_set_annot_callout_line() that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.add_freetext_annot() can supply four or more points to overwrite the stack frame, crashing the process or executing code.\n\n## Affected\n\n- `PyMuPDF >= 1.25.3 < 2.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":235738,"id":"CVE-2026-120752","ts":1794020955765,"field":"exploit_available","old":"false","new":"true"}]}